From mboxrd@z Thu Jan  1 00:00:00 1970
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Nov 2020 18:05:08 +0000
Subject: Re: Creating executable device nodes in /dev?
Message-Id: <ff9aaf77-add3-dbeb-d05e-aedd93d41df0@gmail.com>
List-Id: <linux-hotplug.vger.kernel.org>
References: <CALCETrWM2rGPRudtaQ=mn9MRsrbQqFfZDkOGsBbVMsk6mMw_+A@mail.gmail.com>
 <20201119163245.GN7348@in.waw.pl>
In-Reply-To: <20201119163245.GN7348@in.waw.pl>
MIME-Version: 1.0
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
To: =?UTF-8?Q?Zbigniew_J=c4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>, Andy Lutomirski <luto@kernel.org>
Cc: linux-hotplug@vger.kernel.org, systemd Mailing List <systemd-devel@lists.freedesktop.org>, Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, Jethro Beekman <jethro@fortanix.com>, Casey Schaufler <casey@schaufler-ca.com>, linux-sgx@vger.kernel.org, "Svahn, Kai" <kai.svahn@intel.com>, "Schlobohm, Bruce" <bruce.schlobohm@intel.com>, Stephen Smalley <sds@tycho.nsa.gov>, Haitao Huang <haitao.huang@linux.intel.com>, Ben Hutchings <ben@decadent.org.uk>

On 19.11.2020 18.32, Zbigniew J=C4=99drzejewski-Szmek wrote:
> On Thu, Nov 19, 2020 at 08:17:08AM -0800, Andy Lutomirski wrote:
>> Hi udev people-
>>
>> The upcoming Linux SGX driver has a device node /dev/sgx.  User code
>> opens it, does various setup things, mmaps it, and needs to be able to
>> create PROT_EXEC mappings.  This gets quite awkward if /dev is mounted
>> noexec.
>>
>> Can udev arrange to make a device node executable on distros that make
>> /dev noexec?  This could be done by bind-mounting from an exec tmpfs.
>> Alternatively, the kernel could probably learn to ignore noexec on
>> /dev/sgx, but that seems a little bit evil.
>=20
> I'd be inclined to simply drop noexec from /dev by default.
> We don't do noexec on either /tmp or /dev/shm (because that causes immedi=
ate
> problems with stuff like Java and cffi). And if you have those two at your
> disposal anyway, having noexec on /dev doesn't seem important.

I'd propose to not enable exec globally, but if a service needs SGX, it=20
could use something like MountOptions=3D/dev:exec only in those cases=20
where it's needed. That way it's possible to disallow writable and=20
executable file systems for most services (which typically don't need=20
/tmp or /dev/shm either). Of course the opposite=20
(MountOptions=3D/dev:noexec) would be also possible, but I'd expect that=20
this would be needed to be used more often.

-Topi